GitHub Supports Web Authentication (WebAuthn) for Security Keys

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by michaelmior on Wednesday August 21, 2019 @05:51PM (#20762226)

I would assume that GitHub support would be willing to provide some out of band authentication to allow someone to recover an account if all other options had been exhausted.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by Klathmon on Wednesday August 21, 2019 @07:04PM (#20762866)

I personally hope they dont.

Time and time again it's been shown that one of the weakest links for account security is customer support. It's pretty trivial to gather enough information to impersonate someone well enough for most support reps to believe it's actually you.

It's also part of the reason why SMS is so insecure, because legally most phone companies can't not allow you to transfer your number, and the ways they can verify you are you is limited.

If they do allow support account recovery, I hope they allow the ability to disable it for those who don't want the extra attack vectors.

[ Parent | on HN ]

Re:GitHub Supports Web Authentication (WebAuthn) for Securit... by jeromegv on Wednesday August 21, 2019 @07:42PM (#20763142)

That's the whole point. We do not want that. This leaves us vulnerable to attacks where they take advantage of the support person naiveness.

[ Parent | on HN ]